update 2.0.9

Author: qiwentaidi

core/jsfind/jsfind.go

@@ -13,6 +13,8 @@ import (
 	"strings"
 	"sync"
 
+	"maps"
+
 	"github.com/panjf2000/ants/v2"
 	"github.com/wailsapp/wails/v2/pkg/runtime"
 )
@@ -84,6 +86,7 @@ func ExtractJS(ctx context.Context, url string) (allJS []string) {
 	content := string(body)
 	for _, reg := range regJS {
 		for _, item := range reg.FindAllString(content, -1) {
+			item = strings.TrimSpace(item)
 			item = strings.TrimLeft(item, "=")
 			item = strings.Trim(item, "\"")
 			item = strings.Trim(item, "'")
@@ -261,8 +264,8 @@ func FilterExt(iss []structs.InfoSource) (news []structs.InfoSource) {
 // 处理 API 逻辑
 func AnalyzeAPI(ctx context.Context, o structs.JSFindOptions) {
 	resp, err := clients.SimpleGet(o.HomeURL, clients.NewRestyClient(nil, true))
-	if err != nil || resp == nil {
-		gologger.Error(ctx, fmt.Sprintf("[AnalyzeAPI] %s, error: %v", o.HomeURL, err))
+	if err != nil {
+		gologger.Error(ctx, fmt.Sprintf("[AnalyzeAPI] 请求首页失败 %s, 错误: %v", o.HomeURL, err))
 		return
 	}
 	homeBody := string(resp.Body())
@@ -272,59 +275,127 @@ func AnalyzeAPI(ctx context.Context, o structs.JSFindOptions) {
 		defer wg.Done()
 		api := data.(string)
 
+		// 为每个 API 独立生成 fullURL 和 headers 副本
 		fullURL := strings.TrimRight(o.BaseURL, "/") + "/" + strings.TrimLeft(api, "/")
-		method, err := detectMethod(fullURL, o.Headers)
+
+		// 拷贝 headers，避免竞争
+		apiHeaders := make(map[string]string)
+		maps.Copy(apiHeaders, o.Headers)
+
+		// 检测请求方法
+		method, err := detectMethod(fullURL, apiHeaders)
 		if err != nil {
-			runtime.EventsEmit(ctx, "jsfindlog", fmt.Sprintf("[!] %s : %v", fullURL, err))
+			runtime.EventsEmit(ctx, "jsfindlog", fmt.Sprintf("[!] %s 检测请求方法失败: %v", fullURL, err))
 			return
 		}
 
+		// 如果是 POST 方法，动态探测 Content-Type
 		if method == http.MethodPost {
-			contentType := detectContentType(fullURL, o.Headers)
-			if contentType != "" {
-				o.Headers["Content-Type"] = contentType
+			if contentType := detectContentType(fullURL, apiHeaders); contentType != "" {
+				apiHeaders["Content-Type"] = contentType
 			}
 		}
 
+		// 补全参数
 		param := completeParameters(method, fullURL, url.Values{})
 		if param != nil {
-			runtime.EventsEmit(ctx, "jsfindlog", fmt.Sprintf("[+] %s 已补全参数 %s", fullURL, param.Encode()))
+			runtime.EventsEmit(ctx, "jsfindlog", fmt.Sprintf("[+] %s 已补全参数: %s", fullURL, param.Encode()))
 		}
 
+		// 构建请求对象
 		apiReq := APIRequest{
 			URL:     fullURL,
 			Method:  method,
-			Headers: o.Headers,
+			Headers: apiHeaders,
 			Params:  param,
 		}
+
+		// 检查高风险路由，直接跳过测试
 		for _, router := range o.HighRiskRouter {
 			if strings.Contains(apiReq.URL, router) {
-				runtime.EventsEmit(ctx, "jsfindlog", "[!!] "+fullURL+" 高风险API已跳过测试, 相关敏感词: "+router)
+				runtime.EventsEmit(ctx, "jsfindlog", "[!!] "+fullURL+" 高风险API跳过测试, 触发敏感词: "+router)
 				return
 			}
 		}
+
 		// 测试未授权访问
 		vulnerable, body, err := testUnauthorizedAccess(homeBody, apiReq, o.Authentication)
-		if err != nil || !vulnerable {
-			runtime.EventsEmit(ctx, "jsfindlog", "[-] "+fullURL+" 不存在未授权")
+		if err != nil {
+			runtime.EventsEmit(ctx, "jsfindlog", fmt.Sprintf("[-] %s 测试未授权错误: %v", fullURL, err))
+			return
+		}
+
+		if !vulnerable {
+			runtime.EventsEmit(ctx, "jsfindlog", "[-] "+fullURL+" 不存在未授权访问")
 			return
 		}
-		runtime.EventsEmit(ctx, "jsfindlog", "[+] "+fullURL+" 存在未授权")
+
+		// 存在未授权，记录漏洞信息
+		runtime.EventsEmit(ctx, "jsfindlog", "[+] "+fullURL+" 存在未授权访问！")
 		runtime.EventsEmit(ctx, "jsfindvulcheck", structs.JSFindResult{
 			Method:   method,
-			Param:    param.Encode(),
+			Request:  buildRawRequest(apiReq),
 			Source:   fullURL,
 			Response: string(body),
 			Length:   len(body),
 		})
 	})
 	defer pool.Release()
 
-	// 提交 API 任务到线程池
+	// 提交任务
 	for _, api := range o.ApiList {
 		wg.Add(1)
 		pool.Invoke(api)
 	}
 
 	wg.Wait()
 }
+
+func buildRawRequest(req APIRequest) string {
+	var sb strings.Builder
+
+	parsedURL, err := url.Parse(req.URL)
+	if err != nil {
+		return "" // URL解析失败直接返回空
+	}
+
+	// 如果是 GET 请求，需要将参数附加到 URL 后面
+	if req.Method == http.MethodGet && req.Params != nil {
+		// 编码查询参数并将其附加到 URL
+		queryString := req.Params.Encode()
+		if parsedURL.RawQuery == "" {
+			parsedURL.RawQuery = queryString
+		} else {
+			parsedURL.RawQuery += "&" + queryString
+		}
+	}
+
+	// 写入请求行，只保留Path+Query，不要域名
+	pathWithQuery := parsedURL.Path
+	if parsedURL.RawQuery != "" {
+		pathWithQuery += "?" + parsedURL.RawQuery
+	}
+	sb.WriteString(fmt.Sprintf("%s %s HTTP/1.1\n", req.Method, pathWithQuery))
+
+	// Host 头
+	sb.WriteString(fmt.Sprintf("Host: %s\n", parsedURL.Host))
+
+	// 其他 Headers
+	for k, v := range req.Headers {
+		// 避免重复写 Host
+		if strings.ToLower(k) == "host" {
+			continue
+		}
+		sb.WriteString(fmt.Sprintf("%s: %s\n", k, v))
+	}
+
+	sb.WriteString("\n") // 头结束空一行
+
+	// 写入请求体
+	if req.Method != http.MethodGet && req.Params != nil {
+		// 如果是非 GET 请求，参数放到请求体中
+		sb.WriteString(req.Params.Encode())
+	}
+
+	return sb.String()
+}

core/jsfind/jsfind_test.go

@@ -1,9 +1,11 @@
 package jsfind
 
 import (
+	"fmt"
 	"testing"
 )
 
 func TestJSFInd(t *testing.T) {
-
+	result := detectContentType("http://api", nil)
+	fmt.Println(result)
 }

core/jsfind/method.go

@@ -2,22 +2,20 @@ package jsfind
 
 import (
 	"errors"
+	"maps"
 	"slack-wails/lib/clients"
 	"strings"
 )
 
 func detectMethod(fullURL string, headers map[string]string) (string, error) {
 	resp, err := clients.DoRequest("GET", fullURL, headers, nil, 5, clients.NewRestyClient(nil, true))
-	body := string(resp.Body())
 	if err != nil {
 		if strings.Contains(err.Error(), "doesn't contain any IP SANs") {
 			return "", errors.New("证书中不包含使用的域名/IP, 请求失败")
 		}
 		return "", err
 	}
-	if resp == nil {
-		return "", errors.New("响应内容为空")
-	}
+	body := string(resp.Body())
 	// 模式错误情况 1
 	if (strings.Contains(body, "not supported") && strings.Contains(body, "Request method")) || resp.StatusCode() == 405 {
 		return "POST", nil
@@ -35,40 +33,45 @@ func detectMethod(fullURL string, headers map[string]string) (string, error) {
 }
 
 func detectContentType(url string, headers map[string]string) string {
-	// 先浅拷贝一下headers，避免污染原map
+	// 先浅拷贝一下 headers，避免污染原 headers
 	hdr := make(map[string]string)
-	for k, v := range headers {
-		hdr[k] = v
-	}
+	maps.Copy(hdr, headers)
 
-	// 第一次，不带 Content-Type 测试
+	// 第一次，不带 Content-Type 直接测试
 	resp, err := clients.DoRequest("POST", url, hdr, nil, 10, clients.NewRestyClient(nil, true))
-	if err != nil || resp == nil {
+	if err != nil {
 		return ""
 	}
 
-	// 如果第一次就能正常POST，不需要加Content-Type，默认返回 application/x-www-form-urlencoded
-	if resp.StatusCode() >= 200 && resp.StatusCode() < 300 {
-		return "application/x-www-form-urlencoded"
+	body := string(resp.Body())
+
+	if strings.Contains(body, "not a multipart request") {
+		return "multipart/form-data;boundary=8ce4b16b22b58894aa86c421e8759df3"
 	}
 
-	// 如果出错，或者响应提示Content-Type不对，再带上 application/x-www-form-urlencoded 重试一次
+	// 参数体缺失，一般都为json请求
+	if strings.Contains(body, "Required request body is missing") {
+		return "application/json"
+	}
+
+	// 第一次响应：如果返回 text/plain不支持则需要 content-type 字段
+	if !strings.Contains(body, "not supported") && !strings.Contains(body, "text/plain") {
+		return "text/plain"
+	}
+
+	// 需要重试，带上 application/x-www-form-urlencoded 重新请求
 	hdr["Content-Type"] = "application/x-www-form-urlencoded"
 	resp, err = clients.DoRequest("POST", url, hdr, nil, 10, clients.NewRestyClient(nil, true))
-	if err != nil || resp == nil {
+	if err != nil {
 		return ""
 	}
-	body := string(resp.Body())
 
-	// 判断返回内容
+	body = string(resp.Body())
+
 	if strings.Contains(body, "application/x-www-form-urlencoded") && strings.Contains(body, "not supported") {
 		return "application/json"
 	}
 
-	if strings.Contains(body, "not a multipart request") {
-		return "multipart/form-data;boundary=8ce4b16b22b58894aa86c421e8759df3"
-	}
-
-	// 默认
+	// 默认返回 application/x-www-form-urlencoded
 	return "application/x-www-form-urlencoded"
 }

core/jsfind/openai.go

@@ -0,0 +1,62 @@
+package jsfind
+
+// type UnauthorizedChecker struct {
+// 	client   *openai.Client
+// 	messages []openai.ChatCompletionMessageParamUnion
+// 	model    string
+// 	ctx      context.Context
+// }
+
+// // 定义最大并发数
+// const maxConcurrentRequests = 2
+
+// // 用于控制并发的信号通道
+// var sem = make(chan struct{}, maxConcurrentRequests)
+
+// // NewChecker 初始化
+// func NewChecker(apiKey, baseURL, model string) *UnauthorizedChecker {
+// 	client := openai.NewClient(
+// 		option.WithAPIKey(apiKey),
+// 		option.WithBaseURL(baseURL),
+// 		option.WithHTTPClient(&http.Client{
+// 			Timeout: 5 * time.Second,
+// 		}),
+// 	)
+// 	return &UnauthorizedChecker{
+// 		client: &client,
+// 		model:  model,
+// 		ctx:    context.Background(),
+// 		messages: []openai.ChatCompletionMessageParamUnion{
+// 			openai.UserMessage("你是一个未授权访问检测助手，用户会提供一些接口的返回数据，你需要判断接口的返回数据来判断接口是否需要用户登录。回答用true/false，除了true或false不要输出任何其他内容。"),
+// 		},
+// 	}
+// }
+
+// // Check 输入响应文本，返回是否未授权访问
+// func (c *UnauthorizedChecker) Check(responseBody string) (bool, error) {
+// 	// 获取并发许可
+// 	sem <- struct{}{}
+// 	defer func() {
+// 		// 释放并发许可
+// 		<-sem
+// 	}()
+// 	// 加入新的用户输入
+// 	c.messages = append(c.messages, openai.UserMessage(responseBody))
+// 	chatCompletion, err := c.client.Chat.Completions.New(c.ctx, openai.ChatCompletionNewParams{
+// 		Messages: c.messages,
+// 		Model:    c.model,
+// 	})
+// 	if err != nil {
+// 		return false, err
+// 	}
+
+// 	// 安全处理，防止下标越界
+// 	if len(chatCompletion.Choices) == 0 {
+// 		return false, fmt.Errorf("no choices returned from model")
+// 	}
+
+// 	reply := strings.TrimSpace(chatCompletion.Choices[0].Message.Content)
+
+// 	// 只判断是否返回 true
+// 	return strings.ToLower(reply) == "true", nil
+// }

core/jsfind/param.go

@@ -5,14 +5,15 @@ import (
 	"net/url"
 	"regexp"
 	"slack-wails/lib/clients"
+	"strings"
 )
 
 type Parameter struct {
 	Name string `json:"name"`
 	Type string `json:"type"`
 }
 
-var extractMissingRegex = regexp.MustCompile(`Required (String|Int|Long|Double|Boolean|Date|ArrayList).*?'([^']+)'`)
+var extractMissingRegex = regexp.MustCompile(`(?i)required (string|int|long|double|boolean|date|arraylist).*?'([^']+)'`)
 
 // 从错误信息中提取缺失参数的名称
 func extractMissingParams(message string) *Parameter {
@@ -30,20 +31,20 @@ func extractMissingParams(message string) *Parameter {
 
 // 根据参数类型生成默认值
 func generateDefaultValue(paramType string) interface{} {
-	switch paramType {
-	case "String":
+	switch strings.ToLower(paramType) {
+	case "string":
 		return "test"
-	case "Int":
+	case "int":
 		return 0
-	case "Long":
+	case "long":
 		return int64(0)
-	case "Double":
+	case "double":
 		return 0.0
-	case "Boolean":
+	case "boolean":
 		return false
-	case "Date":
+	case "date":
 		return "1970-01-01"
-	case "ArrayList":
+	case "arraylist":
 		return []string{"1"}
 	default:
 		return "defaultValue"